feat(observability): relay OTLP logs

[afourniernv]

Summary

Add opt-in OTLP logs to the sandbox telemetry relay while keeping traces as the default. This is the sixth draft in the split OTLP relay stack and supports Hermes' separate monitoring plane alongside Relay traces.

Related Issue

Extends NVIDIA/OpenShell#2641 and the work in NVIDIA/OpenShell#3196. This draft does not close either item.

Changes

• Add signal-specific OTLP logs environment injection and /v1/logs ingestion
• Negotiate logs independently through otel_export_logs_v1
• Decode, enrich, bound, queue, and forward OTLP log batches
• Strip spoofed trusted openshell.* metadata from logs before enrichment
• Forward logs through the collector's OTLP/gRPC LogsService
• Keep logs opt-in while preserving trace-only defaults and compatibility
• Add Helm configuration, protobuf bindings, tests, and documentation

Testing

• mise run pre-commit
• cargo test -q -p openshell-supervisor-process otlp
• cargo test -q -p openshell-server otel_relay
• mise run helm:test
• mise run proto:lint
• mise run go:proto:check
• Hermes gateway diagnostics exported through OpenShell to an OTLP collector; /v1/logs received enriched records and workload-supplied openshell.* metadata was removed

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Documentation updated

Stack

• Foundation: rhuss/OpenShell#21
• Explicit relay opt-in: afourniernv/OpenShell#2
• Trusted metadata: afourniernv/OpenShell#3
• Resource bounds: afourniernv/OpenShell#4
• Delivery resilience: afourniernv/OpenShell#5
• This draft is based on codex/3196-stack-delivery-resilience